Security: bump Vite 7.1.11 → 7.3.6 (dev-server CVEs)

[tipatterson-dev]

vite@7.1.11 (devDependency) is flagged for several dev-server vulnerabilities:

• CVE-2026-39363 (7.5) — Arbitrary File Read via Vite dev server WebSocket (GHSA-p9ff-h696-f583)
• CVE-2026-39364 (7.5) — server.fs.deny bypass with queries (GHSA-v2wj-q39q-566r)
• CVE-2026-39365 (5.3) — Path Traversal in Optimized Deps .map handling (GHSA-4w7w-66w2-5vf9)
• plus server.fs.deny Windows alternate-path bypass and launch-editor NTLM disclosure

Affected range: 7.0.0 – 7.3.3. Fixed in 7.3.6 (minor bump, stays on Vite 7).

Scope: all are dev-server issues (npm run dev / npm run host), not production builds — but npm run host binds --host to all interfaces, so worth patching.

Plan: bump devDependency to vite@7.3.6, verify build + dev server + viewer still work.